MALICIOUS TRAFFIC IDENTIFICATION METHOD AND RELATED APPARATUS

Provided are a malicious traffic identification method and a related apparatus. The malicious traffic identification method may comprise: determining a reception time of first alarm traffic; on the basis of a preset policy, acquiring a plurality of pieces of second alarm traffic, which correspond to the first alarm traffic, within a target time period, wherein the target time period is a time period determined on the basis of the reception time, and the similarity between each piece of second alarm traffic among the plurality of pieces of second alarm traffic and the first alarm traffic is greater than a preset threshold value; performing feature extraction on the plurality of pieces of second alarm traffic, so as to obtain first feature information; and on the basis of the first feature information, determining whether the first alarm traffic is malicious traffic. By implementing the embodiments of the present application, the accuracy of malicious traffic identification in an existing network can be improve